sendsafe | ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 16:33

Target

ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe
Size

1.9MB
MD5

805fa2f02b9d95734edda82bc586e2f5
SHA1

6219d9fc30797a0b456e67253819f68648ee6c6d
SHA256

ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6
SHA512

221faab7d3c885e5d655987194fbd509d91f58c19ba86f61a4c622b0f5a066ad3a0a5544d2516826a79920b56952006d7f44889554804230c76688db3402d41c
SSDEEP

49152:1oWrHHJeSUtbtMCiwwxi53lkH4R7+RiiKUE0HcL1M5:ZrHMSUECiizkYARBlE0HQu5

Score

10^/10

Family

sendsafe

Botnet

UNREGISTERED

31.44.184.81:50035

31.44.184.81:50036

Attributes

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/2372-133-0x0000000000400000-0x00000000005EA000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe

pid	process
2372	ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe
2372	ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe

C:\Users\Admin\AppData\Local\Temp\ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe
"C:\Users\Admin\AppData\Local\Temp\ff6f00ac3b14572a520cabdbe5979caf5dabb8d89fc5993d2c83dc6ea75bccd6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372

memory/2372-132-0x00000000024B0000-0x0000000002662000-memory.dmp

Filesize
1.7MB

Download
memory/2372-133-0x0000000000400000-0x00000000005EA000-memory.dmp

Filesize
1.9MB

Download